CVE-2024-25627: Cross-Site Scripting (XSS) via File Upload in Alf.io
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alf.ioto a version that resolves this vulnerability.Fixed in 2.0-M4-2402
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25627?
CVE-2024-25627 is considered a critical vulnerability due to its potential for enabling persistent access through unauthorized HTML file uploads.
How do I fix CVE-2024-25627?
To fix CVE-2024-25627, ensure that you update the Alf.io application to a version above 2.0-m4-2304 to mitigate the risk.
Who is affected by CVE-2024-25627?
CVE-2024-25627 affects all versions of Alf.io up to 2.0-m4-2304 that allow administrator users to upload HTML files.
What type of attack can CVE-2024-25627 facilitate?
CVE-2024-25627 can facilitate cross-site scripting (XSS) attacks by allowing an attacker to upload malicious HTML content.
Is administrative access required to exploit CVE-2024-25627?
Yes, administrative access to the Alf.io application is required to exploit CVE-2024-25627 and upload the malicious HTML files.